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^\l , Abstract. Given a fc-dimensional subspace M C R" and a full rank integer lattice £ C R" , the subspace 

, ■ avoiding problem SAP, defined by Blomer and Naewe [BN07],is to find a shortest vector in £\M. Treating 

O ' fc as a parameter (in the sense of parameterized complexity), we obtain new parameterized approximation 
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and exact algorithms for SAP based on the AKS sieving technique [AKSOI]. 

Our first result is a randomized (1 + e) -approximation algorithm for parameterized SAP that runs in 
^3 \ time 2 '"'.(l/e)'", where the parameter A: is the dimension of the subspace M. Thus, we obtain a2 '"' 

Cn ! time algorithm for e = 2-°'"'"=' . 

Several of our algorithms work for all gauge functions as metric with some natural restrictions, in 
particular for all ip norms. We also prove an i?(2") lower bound on the query complexity of AKS 
sieving based exact algorithms for SVP that accesses the gauge function as oracle. 
Next, we give a 2 '""'"'° '°^ ^' exact algorithm for the parameterized SAP for any Ip norm. 
C/3 , This implies a 2 '"' time randomized algorithm for computing the «"* successive minima of rank n lattice 

^, ' for any (.p norm if i is 0{n/ log n). It is known that computing all n successive minima's is equivalent to 

the problems CVP, SIVP [M08]. So our result can be thought of as a step forward in getting 2^"' time ran- 
domized algorithm for CVP. We also give a randomized 2 '"' time algorithm for CVP if the input instance 
^ ' satisfies certain promise. We also give a new algorithm for the Theta-series problem for which parameter- 

^^ \ ized hardness results are shown in [DFVW99]. Furthermore, we study a new parameterized version of SVP, 

^T ■ CVP, and SAP and show that these parameterized CVP and SAP have randomized s^^' time algorithms, 

r^ ' where k is the parameter and s is the input size, and are hard for the class W[l]. 

^' 

O \ 1 Introduction 

oo 

o 

Fundamental algorithmic problems concerning integer lattices are the shortest vector problem (SVP) 
and the closest vector problem(CVP). Given a lattice C C M" by a basis, the shortest vector problem 
/\ • (SVP) is to find a shortest non zero vector in C w.r.t. some metric given by a gauge function in general 

S , (usually the Ip norm for some p). Likewise, the closest vector problem (CVP) takes as input a lattice 

£ C W^ and vector f G M" and asks for a -u G £ closest to v w.r.t. a given metric. These problems have 
polynomial-time approximation algorithms based on the celebrated LLL algorithm for basis reduction 
[LLL82]. 

More recently, Ajtai, Kumar and Sivakumar in a seminal paper [AKSOI], gave a 2^^'^'^ ■ poly(s) 
time randomized algorithm to find a shortest nonzero vector in the lattice w.r.t. the C2 norm, where 
s is the size of the input in binary encoding. In subsequent work [AKS02] they also gave a 1 + e 
randomized approximation algorithm of similar running time for CVP. Their algorithms are based on 
a generic sieving procedure that exploits the underlying geometry. 

Earlier, Kannan [Kan87] has given 2*^("'°s") • poly(s) time deterministic algorithms for exact 
solutions to both SVP and CVP. The best known deterministic algorithm for CVP is due to Blomer 
[BlOO] which runs in time 0{n\s^^^^) where s is input size. Recently, Blomer and Naewe [BN07] 
introduced the subspace avoiding problem (SAP) that generalizes SVP and CVP. In SAP the input 
instance is a lattice C and subspace M C M" and the goal is to find a shortest vector in £ \ M. 
Using a variant of the Ajtai-Kumar-Sivakumar sieving procedure Blomer and Naewe [BN07] describe 
a randomized 1 + e approximation algorithm for SAP that runs in time (2 + 1/e)", for any ip norm. 



In the first part of the present paper we focus on SAP. We treat the dimension dim(M) = /c as a 
parameter and obtain approximation and exact algorithms for SAP whose running time and approx- 
imation guarantee are sensitive to the parameter k. Our results are also based on the AKS sieving 
procedure [AKS01,Re]. We summarize our main results below: 

- We give 2'^("+'^'°s^/'^' time randomized algorithm to solve 1 + e approximation of the param- 
eterized SAP problem, where n is rank of the lattice and k is the dimension of subspace. Our 
algorithm works w.r.t. any gauge function satisfying some natural conditions. This generalizes 
and improves on the result of Blomer and Naewe [BN07], when the dimension of the subspace 
involved is small. We also propose a generalization of SAP (the convex body avoiding problem) 
and give a singly exponential algorithm for 1 + e approximation of the problem. We use this to 
give an algorithm for the theta-series problem [DFVW99] for lattices. 

- We give a randomized algorithm to exactly solve parameterized SAP with running time 
20(n+k logfc) ^g ^^ implication of this we obtain a 2'-'^"'' randomized algorithm to find i*'' succes- 
sive minima for any £p norm if i is 0{n/ log n). This also yields a 2'^(") randomized algorithm that 
exactly solves CVP instances (£, v) with d{£, v) < \/3/2 • Xt{C), where A((£) is t*'* successive 
minima of C w.r.t. £2 norm for t = 0{n/ log n). 

- Motivated by the parameterized complexity classes [DF99,DFVW99] we introduce and study a 
new parameterization of SVP, CVP, and SAP and show some upper and lower bound results. 

Finally, we consider the unique-CVP problem. R. Kumar and D. Sivakumar in [KS99] have 
proved that unique-SVP is NP-hard under randomized reductions for £2 norm. We give a randomized 
polynomial-time reduction from the search version of CVP to the search version of unique-CVP for 
any Ip norm, 1 < p < 00. Likewise, we can give a similar reduction showing hardness of unique-SAP 

2 Preliminaries 

A lattice Cis a. discrete additive subgroup of i?", n is called dimension of the lattice. For algorithmic 
purposes we can assume that C C Q", and even in some cases C C Z". A lattice is usually specified 
by a basis B = {61, • • • , bm}, where bi G Q" and 6j's are linearly independent, m is called the 
rank of the lattice. The lattice is called full-rank iim = n. Though most of the results in the paper are 
applicable for general lattices, for convenience we mainly consider only full-rank lattices in this paper. 
For X G Q" let size(a:) denote the number of bits for representing x in standard binary representation. 
Let size(£) denote number of bits for representing the basis vectors b'^s. Next we define a gauge 
function which generalizes the notion of usual Ip norms. 

Definition 1 (gauge function [Si45]). A function f : M" -^ M is called a gauge function if it satisfies 
following properties: 

1. f{x) > Ofor all xeW'\ {0} and f{x) = Oifx = 0. 

2. f{Xx) = Xf{x)forall xeM.'^andXe R. 

3. f{x + y)<f{x) + f{y)forallx,yeR^. 

For V G M" we denote f{v) by \\v\\f and call it norm of v with respect to gauge function /. It 
is easy to see that any Ip norm satisfies all the above properties. Using a gauge function / we can 
easily define a metric d on M" simply by assigning d{x, y) = f{x — y) for all x,y € W\ For x G 
and r > 0, let Bf{x,r) denote a ball of radius r around x with respect to the gauge function /, 
i.e. Bf{x,r) = {y G E."'\f{x — y) < r}. We call Bf{x,r) as f-ball of radius r with center x. We 
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denote the metric balls with respect to usual Ip norm by Bp{x, r). Unless specified particularly we are 
always considering balls in n dimensional space. Next proposition characterizes the class of all gauge 
functions. We state it without proof. For the proof see, e.g. [Si45]. 

Proposition 1. Let f : M" -^ M. be any gauge function then a unit radius ball around origin with 
respect to f is an dimensional bounded 0-symmetric convex body. Conversely for any n dimensional 
bounded 0-symmetric convex body C, there is a gauge function f : M" -^ M such that Bf{0, 1) = C. 

Given a ball of radius r around origin with respect to a gauge function /, from the Proposition 1 
it follows that Bf{0, r) is an 0-symmetric convex body. It is easy to check that for any r > and 
any constant c we have vo\{Bf{0, cr)) = c"vol(i?j(0, r)), where vol(C) denotes the volume of the 
corresponding convex body C (see e.g. [Si45]). 

We make a technical assumption regarding a gauge function /. For some polynomial p{n), 
52(0,2-P(")) C Bf{0,l) C S2(0,2P(")), i.e. there exists a Euclidean sphere of radius 2-p(") in- 
side the convex body Bf{0, 1), and Bf{0, 1) is contained inside a Euclidean sphere of radius 2P^"'\ 
We call a gauge function given by a membership oracle as nice gauge function if it satisfies this prop- 
erty. Note that if / is a nice gauge function and v G Q" we have size(/(t;))=poly(n,size(f )). For a nice 
gauge function / we can sample points from convex body i?/(0, r) almost uniformly at random in 
poly(size(r),n) time using Dyer-Frieze-Kannan algorithm [DFK91]. Note that, this assumption is not 
restrictive and fairly standard, e.g. all Ip norms p > 1 satisfy this property. The i*^ successive minima 
of a lattice C with respect to a gauge function / is smallest r > such that Bf{0, r) contains at least 
i linearly independent lattice vectors. It is denoted by Af (£). We denote i*^ successive minima with 
respect to usual Ip norm by A^(£). 

Remark 1. It is important to note that given an input lattice £ C M" and a gauge function / as an 
oracle, we have a linear transform A : 7/^ ^ C where Z" is the standard lattice, which is a lattice 
isomorphism. Furthermore, the function g{x) = f{A{x) is a nice gauge function on Z" with which 
we can work instead of {C, f). However, we find it convenient to allow for both C and / to be input. 

3 Approximation algorithm for SAP for any gauge function 

We first describe the AKS sieving procedure [AKSOl] for any gauge function, analyze its running 
time and explain its key properties. The following lemma is crucially used in the algorithm. 

Lemma 1. [Sieving Procedure] Let f : M" -^ R be any gauge function. Then there is a sieving 
procedure that takes as input a finite set of points {vi, V2, V3, . . . , Vjv} Q ^/(O) ''')> ^^d. in N^^' time 
it outputs a subset of indices S C [N] such that \S\ < 5" and for each i G [N] there is a j £ S with 

f{y^ - yj) < r/2. 

Proof The sieving procedure is exactly as described in O. Regev's lecture notes [Re]. The sieving 
procedure is based on a simple greedy strategy. We start with S" = and run the following step for 
all elements Vi,l < i < N. At the i step we consider Vi. If f{vi — Vj) > r/2 for all j £ S 
include i in the set S and increment i. After completion, for all i € [N] there is a j G S such 
that f{vi — Vj) < r/2. The bound on \S\ follows from a packing argument combined with the fact 
that vo[{Bf{0,cr)) = c"vol(i?j(0, r)) for any r > and a constant c > 0. More precisely, for 
any two points Vi,Vj G 6* we have f{vi — Vj) > r/2. Thus, all the convex bodies Bf{vi,r/A) for 
Vi e S are mutually disjoint and are contained in -6/(0, r + r/4). Also note that vol(i?/(0, dr)) = 



(r-vol{Bf{0,r)) for any constant d > 0. It follows that 5"vol(S/(wj,r/4)) > vol{Bf{0,r + r/4)). 
Hence, IS*] < 5". The second property of S is guaranteed by the sieving procedure. ■ 

We give a 2'^^") • (l/e)'^^'^) time randomized algorithm for computing a (1 + e) approximate 
solution to an instance (£,M) of SAP, treating the dimension dim(M) = A; as a parameter. This 
algorithm is based on a different analysis of the AKS sampling procedure than described by Blomer 
and Naewe [BN07], and it works for any gauge function. Suppose, without loss of generality, that the 
input lattice C C M" is n-dimensional given by a basis {bi, • • • , 6„}, so that C = Y17=i ^ " ^i- Let us 
fix a nice gauge function / and let t; G £ denote a shortest vector in i2 \ M, i.e. /(x) for x G £ \ M 
attains minimum value at x = v. Let s = size(£, M) denote the input size (which is the number of 
bits for representing the vectors bi and the basis for M). As w is a shortest vector in £ \ M and / is a 
nice gauge function it is quite easy to see that size{f{v)) is bounded by a polynomial in s. Thus, we 
can scale the lattice C to ensure that 2 < /(tj) < 3. More precisely, we can compute polynomially 
many scaled lattices from C, so that 2 < /(v) < 3 holds for at least one scaled lattice. Thus, we can 
assume that 2 < f{v) < 3 holds for the lattice C. 

Proposition 2. Let C C M" be a rank n lattice, v £ C such that 2 < f{v) < 3 for a nice gauge 
function f. Consider the convex regions C = Bf{—v, 2) n Bf{0, 2) and C = Bf{v, 2) n Bf{0, 2). 

Then C = C + vand vol{C) = vol{C') = ^ C^^^J^T^^ )- 

The Proposition 2 immediately follows since Bf{-v/2,l/2) C C,Bf{v/2,l/2) C C". Next, our 
algorithm follows the usual AKS random sampling procedure. 

Let R = n- maxiWbiWf. It is clear that size(i?) is polynomial in s since / is a nice gauge function. 
Let -6/(0, 2) denote the /-ball of radius 2 around the origin. Since we have an oracle for membership 
in -6/(0, 2) we can almost uniformly sample from -6/(0, 2) using a well-known algorithm [DFK91]. 
Let xi, X2, • • • , xn denote such a random sample, for N = 2^("+'^'°s(i/'=)) • log R where the constant 
c > will be suitably chosen. Now, using the lattice C we can round off the points Xj. More precisely, 
we express Xj = SjOijbj for rationals a-ij. Then, from each vector Xj we compute the vector yi = 
EjPijbj, where < /3ij < 1, by adding appropriate integral multiples of the bj's to the expression 
for Xj. Thus, the points yi , • • • , y^r are in the interior of the fundamental parallelepiped of C, and each 
Xi — Vi £ C We denote this by t/i = Xj(mod £). We now have the set of N pairs Z = {(yj, Xj) | 
i G [N]}, where Xj — t/i are lattice points. Since yi lie inside the fundamental parallelepiped we have 
WVillf ^ n ■ maxi\\bi\\f = R for i = Ito N. 

Now, we apply the AKS sieving procedure in Lemma 1 to the set {yi, ^2, • " " ) yA^}- The result is 
a subset 5 C [N] of at most 5" indices such that for each i G [N] there is some j £ S such that 
fiVi ~ Vj) ^ R/2. We remove from Z all {xj,yj) for j £ S and replace each remaining {xi,yi) G Z 
by a corresponding (xj, yi — {yj — Xj)), where j G S* is the first index such that /(yj — yj) < R/2. 
After the sieving round, the set Z has the property that for each (xj, Zj) G Z we have Xi — Zi £ C and 
f{xi — Zi) <2 + R/2, and Z has shrunk in size by at most 5". We continue with 0(log R) sieving 
rounds so that we are left with a set Z with N — 0(log -R)5" pairs (xj, Zi) such that Xi — Zi £ C and 
f{xi — Zi) < 8. We can ensure that I Z| > 2'^i(""'"'^'°s(i/'^)) for an arbitrary constant ci by appropriately 
choosing constant c. The vectors, Xj — Zi for {xi,Zi) G Z follows some distribution among lattice 
points inside -6/(0, 8). 

We now describe the approximation algorithm, its proof of approximation guarantee and running 
time bound in the following theorem. 

Theorem 1. Let C be a lattice with a target vector v £ C\ M such that 2 < f{v) < 3 for a given 
gauge function f and f{v) < f{x) for all x £ C\ M. Then there is a randomized algorithm that in 



time 2'^("+'='°3(i/^)).poly(size(£)) computes a set Z of pairs {xi, Zi) such that \Z\ > 2^1 ■("+'= i°g(i/^)) 
for a constant c\ and f(xi — Zi) < 8 for all (xj, Zi) G Z. Moreover, Zi — Xi £ C are such that with 
probability 1 — 2~'-^("' there is a pair of points (xj, Zj), {xj, Zj) G Z such that v + u = {xi — Zi) — 
{xj — Zj)for a vector u £ C with f{u) < e. 

Proof. Consider the set Z of pairs (xj, Zi), obtained after the AKS sieving as described above, such 
that \Z\ > 2^i("+'^'i°s(V^)), and f{xi - Zi) < 8 for all {xi,Zi) G Z. Consider the /c-dimensional 
sublattice L' = Cn M whose basis we can efficiently compute from C and M. Write Z as a partition 
Z = UTLi -^j' where for each Zj there is a distinct coset L' + Vj of L' in C such that Zi — Xi £ L' + Vj 
for all (xj, Zi) G Zj. Let Z', = {zi — Xj | (xj, Zi) G Zj}. Suppose Uj G Z', C L' + Vj for j = 1 
to m. Then, as f{v) > 2, f{uj — uc) > 2 for j / £. Hence unit radius /-balls around Uj's are 
disjoint. Since vol(i?j(0, 8))/vol(i?/(0, 1)) < 2'^ " for some constant c', we will choose the constant 
ci large enough so that \Zi'\ > 2'^ (n+kiog(i/e)) ^^j. gQj^g large constant d' and some index i'. Let 
W = {zi - Xi \ {xi,Zi) G Zii]. Now, let T be any subset of W so that /(/? -/?')> e for all 
/3, /3' G T. Then Bf{/3,e/2) are all disjoint /c-dimensional /-balls for /3 G T. By a packing bound 

it follows that \T\ < ( ^f^ ) which is 2'^('^'°s(^/'^)). Note that we can use packing argument for 
fc-dimensional balls since W is contained in a coset of k dimensional subspace M. Thus, for suitably 
large constant d' we will have 2*^^") many (3 £ W that are inside Bf{P' , e/2) for a specific /3' G T. 

Now, we apply the argument as explained in Regev's notes [Re] to reason with a modified distribu- 
tion of the Xj. Firstly, by Proposition 2 we have convex region C = Bf{0, 2) n Bf{—v, 2) C -6/(0, 2) 
such that vol(C) > vol(B/(0,2)) • 2-<^("), C = C + v C 5/(0,2) and C n C + v = (/}. Since 
vol((7) > vol(B/(0,2)) • 2-°(") and \Z\ > 2^i-("+'=i°s(iA)) where we can choose the constant ci 
suitably large, it follows that in the beginning with high probability there are 2'^("+^'°s(i/'=)) pairs 
(xj, Zj) G Z such that Xj G C. Now, notice that we can replace the original distribution of Xj with a 
modified distribution in which we output Xj if it lies in Bf{0, 2) \ (C U C) and if Xj G C it outputs 
either Xj or Xi + v with probability 1/2 each. Similarly, if Xj G C" = C + f it outputs either Xj or 
Xi — V with probability 1/2 each. This modified distribution coincides with the original distribution, 
and is introduced only for the purpose of analysis. Now, putting it together with the previous argu- 
ment, this is easily seen to imply that with high probability we are likely to see v + {(3' — (5) as the 
difference of Zi — Xj and Zj — Xj for some two pairs (xj, Zj), (xj, Zj) G Z, for some /3', f3 £ T. Since 
v + {(3' - (3) G £ \ M and /(/?'- /3) < e, v + {f3' - f3) is actually 1 + e approximation of v. The 
actual algorithm will examine all {zi — Xj) — {zj — Xj) for (xj, Zi), {xj, Zj) G Z obtained after sieving 
and output that element in £ \ M of minimum /-value. This completes the proof of correctness of the 
approximation algorithm. ■ 

An immediate consequence of the above theorem is a randomized 1 + e approximation algorithm 
for the parameterized SAP problem that runs in time 2'^("+^'°s 7> ■ poly[size{£, M)). 

Corollary 1. Given a rank n lattice C and a k-dimensional subspace M C M", there is 1 + e ran- 
domized approximation algorithm for parameterized SAP (for any nice gauge function) with running 
time 20("+fcl°S7) ■poly{size{C,M)). 

4 An exact 2^("+'^ '°g '^) algorithm for SAP 

In this section we give an exact algorithm for SAP. In particular, given a basis {bi, • • • , 6„} of an 
integer lattice C C M" of rank n and a subspace M C M" of dimension k we give a randomized 
algorithm to find a shortest vector in £ \ M with respect to Ip norm in time 2'~'^'^^^^"^''>poly{s) 



where s = size{C, M). As an immediate corollary we get a 2'^(") randomized algorithm to find i^^ 
successive minima w.r.t. any Ip norm in an integer lattice £ if i is 0(n/ log n). Using ideas similar 
to Kannan's reduction from CVP to SVP ([Kan87]) we also get a hierarchy of algorithms for CVP 
depending upon the distance of given point from the lattice. Our exact algorithm uses the same sieving 
procedure as an approximation algorithm for SAP described in the Section 3. Note that without loss of 
generality we can assume that a shortest vector v ^ C\ M satisfies 2 < \\v\\p < 3. Next we describe 
the algorithm. 

1. Let N = 2^" log(n.r7T,axj||6j||p) and pick xi, X2, • • • , xn uniformly at random from Bp{0, 2). 

2. Let t/i = Xi(mod C) and apply the AKS sieving procedure on the set {{xi,yi), • • • , (xat, yN)} as 
described in the Section 3 until for all tuples {xi, Zi) left after the sieving, ||a:j — Zi\\p < 8. 

3. Let Z = {{xi, Zi)\i G T},T C [N] be the set of tuples left after the sieving procedure. For all 
i,j G T compute lattice points Vij = {zi — Xi) — {zj — Xj). 

4. Let Wij is a closest lattice vector to Vij in the rank k lattice P = CnM and let rij = Vij — Wij. 
Output a vector of least non zero ip norm among all the vectors rij for i, j G T. 

First we prove the correctness of the algorithm. 

Claim. For appropriate choice of the constant c the algorithm outputs a shortest non zero vector in 
C\ M with respect to £p norm. 

Proof. Let t; is a shortest vector in £ \ M. Consider the set of tuples left after the sieving procedure 
Z = {{xi,Zi)\i G T},T C [N]. From arguments in the Theorem 1 it follows that for appropriate 
choice of the constant c with "good" probability Z contains tuples (xj, Zi), {xj, Zj) such that Xj, Xj G 
C = Bp{0, 2) n Bp{—v, 2) and Zj — Xj, Zj — Xj lie in the same coset of P, i.e. if (3i = Zi — Xj and 
f3j = Zj — Xj then /?j — Pj G P. In fact we argued that there are "many"such tuples, the fact which 
is not essential for the current theorem. Since Xj is chosen uniformly at random from Bp{0, 2) we can 
replace it by equivalent uniform random sample as in Theorem 1. Since Xj G Bp{0, 2) n Bp{—v, 2) 
we replace Xj by Xi + v with probability 1/2. Therefore in the Step 3 of the algorithm with good 
probability we have Vij = {zi — Xi — v) — {zj — Xj) = —v + Pi — (ij. Let Wi^j G P is a closest 
vector to v-i^j. So we have d{vij,Wij) < d{vij,(3i — (5j) = || — v\\p, i.e. ||fjj — tL'^jHp < \\v\\p. But 
since Vij — wij ^ P and i; is a shortest vector in £ \ M, this implies \\vij — Wij \\p = \\v\\p. So with 
good probability in Step 4 the algorithm will output a vector rij with ||rj j||p = ||f ||p. This proves the 
correctness of the algorithm. ■ 

Next we show that the running time of the algorithm is 2'^("+'^'°sfc) . poly{s) where s is the input 
size. In Step 1 of the algorithm we are sampling Appoints fromi?p(0, 2), a ball of radius 2 with respect 
to Ip norm. Since i?p(0, 2) is a convex body, the task can be accomplished using Dyer-Frieze-Kannan 
algorithm [DFK91] in time 2*^(") ■poly{s). It easily follows that the sieving procedure in Step 2 can be 
performed in 2'^(") time. Note that P is a rank k lattice and a basis for P can be efficiently computed 
in polynomial time using linear algebra. In the Step 4 of the algorithm we are solving 2*^^"' many 
instances of CVP for the rank k lattice P. For i,j G S a closest vector to Vij in the rank k lattice P 
can be computed in 2'^^^ '°s ^' time using Kannan's algorithm for CVP [Kan87]. Hence the Step 4 takes 
20{n+kiogk) tjjjjg Therefore the overall running time of the algorithm is 2'^("+^^°g'^) • poly[s). Note 
that by repeating above algorithm 2'^^'^' times we can make the success probability of the algorithm 
exponentially close to 1. 

Theorem 2. Given an integer lattice C of rank n and a subspace M C M" of dimension k < n, 
There is a randomized algorithm to finds v £ C\ M with least possible Ip norm. The running time 



of the algorithm is 2'^("'+'^l°s^) times a polynomial in the input size and it succeeds with probability 
1 — 2~'^^for an arbitrary constant c. 

Given an integer lattice £, Blomer and Naewe [BN07] gave 2"^^") time 1 + e factor approximation 
algorithm to compute i*^ successive minima in the lattice £ for i = 1 to n. In the recent paper 
Micciancio [M08] has shown that the problem of computing linearly independent vectors vi, . . . ,Vn G 
C such that ||fi|| < Xi{C) is deterministic poly-time equivalent to the problems CVP and SIVP. As 
an easy implication of the Theorem 2 we get a 2'^(") algorithm to compute i*^ successive minima for 
i < en/ log n for an arbitrary constant c. 

Corollary 2. Given an integer lattice C of rank n and a positive integer i <n, there is a randomized 
algorithm with running time 2'^("+*'°s*) • poly[size{C)) to compute Vi £ C such that \\vi\\p = A^(£). 
In particular ifi < en/ log nfor an arbitrary constant e then there is an exact 2 '-"^ • poly{size{£)) 
time randomized algorithm to compute i*^ successive minima of the lattice C. 

Corollary 3. Given integer lattice C of rank n and v G Q" with promise that d{v, C) < \/2>/2Xt{C), 
t < n. Where Ai(£) denotes t*^ successive minima of C with respect to £2 norm, then there is a 
20{n+tiogt) . poly(^size{C)) time randomized algorithm to compute a closest lattice point to v. 

Proof. By Corollary 2 we first compute \t{C). We now use ideas from Kannan's CVP to SVP reduc- 
tion [Kan87]. Let hi,h2,- • • ,hnhe. n basis for C. We obtain new vectors q G Q'^+^ for i = 1 to n by 
letting cf = (6f , 0). Likewise, define u € Q"^^ as u^ = (f ^, Ai/2). Let M. be the lattice generated 
by the n + 1 vectors it, ci,C2, • • • c^. Compute the vectors Vj £ J\A such that ||fj||2 = Xj{M) for 
J = 1 to t using Corollary 2 in time 2'^("+*^°s*) . poly{size{C)). Write vectors Vj as Vj = Uj + ajU, 
Uj G jC{ei, • • • ,c„) and aj G Z. Clearly, \aj\ < 1 since u has Ai/2 as its (n + 1)*^ entry. As 
d{v, C) < \/3/2Ai(£) we have d{u,A4) < Xt{C). Hence, there is at least one index i,l<i<t such 
that \ai\ = 1. Consider the set S = {vi \ 1 < i < t,\ai\ = l}and let Uj be the shortest vector in S. 
Writing Uj = {wj, 0), it is clear that the vector —Wj G £ is closest vector to v if aj = 1 and Wj is a 
closest vector to f if a^ = — 1. ■ 



5 The Theta- Series Problem for lattices 

The Theta-Series problem for integer lattices takes as input a lattice C and an integer parameter k 
and asks if C has a vector such that \\v\\2 = k. This problem is shown to be hard for both NP and 
parameterized complexity class W[l] in the paper by Fellows et al [DFVW99]. However, they do not 
show any upper bound results; In this section we apply the AKS sieving method to give a {kp)^^"^' 
algorithm for solving the Theta-Series problem for all ^p-norms. We actually solve a more general 
problem defined below. 

Definition 2. Convex-Body Avoiding Problem (CAP) For an integer lattice C of rank n and an O- 
symmetric convex body C in M", the convex-body avoiding problem is to find a v £ C\C with least 
possible ip norm, where we assume that the convex body C is given by a membership oracle. 

Theorem 3. Given integer lattice C of rank n and an 0-symmetric convex body C in M", there isl + e 
factor approximation algorithm to solve CAP (w.r.t. any £p norm) with running time 2'^("'^°^(^''^' • 
poly{size{C)). 
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Proof. We claim that it suffices to solve the problem for the case when C is n-dimensional. To see 
this, suppose C is contained in some fc-dimensional subspace M of M". We can find a basis for M 
with high probability by using the polynomial-time almost uniform sampling algorithm from C using 
[DFK91]. Next, we compute the lattice C f\ M and find a (1 + e) approximate solution u for the 
/c-dimensional convex body avoidance for the lattice £ n M and C. We also solve the SAP instance 
(£, M) and find a (1 + e) approximate solution v ^ C\ M using Theorem 1. The smaller of u and v 
is clearly a (1 + e) approximate solution for the input CAP instance. 

Thus, we suppose C is n dimensional. Let t; be a shortest vector in £ \ C which, as before, 
we can assume satisfies 2 < ||?;||p < 3 by considering polynomially many scalings of the lattice 
and the convex body. As in Theorem 1, we pick random points xi, • • • , xn from Bp{0, 2) for N = 
2cniog(i/e) .ppiy^gy xhe constant c > will be suitably chosen later. Let yi = Xj(mod C) for i = 1 to 
N. We apply several rounds of the AKS sieving on the set {{xi, yi), • • • , {xn, Un)} until we are left 
with a set 5of 2^i"^°s(i/e) pairs (xi, Zi) such that ||xj — Zj||p < 8. From proposition 2 it follows easily 
that with good probability we have Z (1 S such that \Z\ > 2'=2r!.iog(i/e) ^^^^ f^j. ^^ (^^.^ ^^-j g Z we have 
Xi G DUD' where D = Bp{0,2)nBp{-v,2) and D' = 5^(0, 2)nSp(i;, 2). Note that the the constant 
C2 can be chosen as large as we like by appropriate choice of c. Let Z' = {zi — Xi \ {xi,Zi) G Z}. 
Now consider £p ball of radius e/2 centered at each lattice point (3 G Z'. It is clear that for all 
(3 G Z', Bpifi, e/2) C 5p(0, 8 + e/2). If for all [3 e Z' tp balls Bp{[3, e/2) are mutually disjoint, 
by packing argument we get \Z'\ < i^%\l = 2^^ "i°g(i/'=) for a constant c'. We choose constant c 
appropriately to ensure that C2 > c'. This implies that there exists tuples (xj, Zj), (xj, Zj) G Z such 
that \\(5i — [5j\\ < e, where (5i = zi — Xj and I5j = Zj — Xj. Let j3 = fii — [3j. We claim that it is not 
possible that both (5 + v,[3 — vlie. inside the convex body C. Because this implies v — (5 ^ C since 
C is 0-symmetric. Therefore v = "") ^y"" p) ^ (j^ which contradicts with assumption v ^ C. So 
without loss of generality assume that f3 + v ^ C. Note that without loss of generality we can also 
assume that Xj G D' with good probability. Now, we apply the argument as explained in Regev's notes 
[Re] to reason with a modified distribution of the Xj. As Xj G D' we can replace xi by xi — v. So it is 
easy to see that after sieving with good probability there exists tuples (xj, Zi), {xj, Zj) G S such that 
nj = {zi - Xi) - {zj - Xj) = V + Pi- (3j. So rij = v + (5 ^ C and clearly \\rij\\p < (1 + e)\\v\\p 
since ||/3i — /3j||p < e. It is easy to see that the algorithm runs in time 2'^("''°s(iA))po/y(size(£)). This 
completes the proof of the theorem. ■ 

Next we give an algorithm to solve the Theta-Series problem using Theorem 3. 

Corollary 4. Given an integer lattice C Q Tj"'' of rank n and an integer k, there is a 2'^'"^°s(«:p)) . 
poly{size{jC)) time randomized algorithm to decide whether C contains a vector v such that \\v\\p = 
k. 

Proof. First we describe the algorithm. Let m G Q such that (fc— 1)^'^ < m < {k — l/2)^'P. Let C be 
the convex body Bp{0, m). We choose e < (1 + 2l)^^^ ~ 1 ^i^d run the 1 + e approximation algorithm 
described in the Theorem 3 on the instance (£, C) of CAP with respect to ip norm. Output "YES" if 
the algorithm outputs a vector u such that \\u\\^ = k otherwise output "NO". To see the correctness of 
the algorithm, suppose that C contains a vector v such that \\v\\p = k. It is easy to see that v is shortest 
vector in £ \ C. The approximation algorithm in Theorem 3 outputs a vector u ^ C\C such that with 
good probability \\u\\p < (1 + e) • \\v\\p. This implies \\u\\p < (1 + l/2k) • k = k + 1/2. But since 
C is an integer lattice this in fact imphes ||m||p = fc. It is easy to see that the algorithm runs in time 
20(niog(fcp)) .j3o/y(size(£)). ■ 



6 A lower bound result 

The AKS sieving procedure is a breakthrough technique for showing upper bounds for various lattice 
problems. In this paper too we have provided new examples. The AKS technique is actually generic; 
as we have shown in this paper, it works for all nice gauge functions. In this section we prove a lower 
bound result showing that essentially this generic property of AKS sieving makes it unlikely to give 
algorithms that are asymptotically faster than the 2*^'-") bound. 

Consider the problem of finding all shortest nonzero vectors in a lattice £ C M" with respect to 
a nice gauge function / : M" -^ M. The algorithms we consider take a basis for C as input and the 
nice gauge function / is given by oracle access: the oracle outputs f{x) for a query x. The query 
complexity of the algorithm is the worst-case number of queries that it makes for inputs {C, f). Now, 
the AKS sampling algorithm [AKS01,Re] can be used to compute all the shortest vectors in the integer 
lattice C with respect to £2 norm in time 2'^^"). As explained in this paper (in Section 3 and later), 
the AKS -sampling can be easily adapted to work for any nice gauge function / where / is given by 
oracle access. 

We now show a lower bound on the query complexity of any such algorithm based on an adversary 
argument. For the lower bound theorem we fix the lattice as the standard lattice Z" and consider only 
those nice gauge functions / : M" ^ M such that there are at most n^ many shortest nonzero vectors 
in Z" with respect to /. Let T denote this family of nice gauge functions. The proof of the following 
theorem is given in the appendix. 

Theorem 4. The query complexity of any deterministic/randomized algorithm that takes as input the 
standard lattice Z" and a nice gauge function f G J^ as an oracle and outputs a list of all shortest 
nonzero vectors in Z" with respect to the gauge function f is 2^("). 

7 A natural parameterization for lattice problems 

In this section we introduce and study a natural parameterized version for lattice problems, motivated 
by similar problems for codes that have been studied in the parameterized setting by Downey et al 
[DFVW99,DF99]. 

Let £ C M" be an integer lattice given by a basis 61, 62, • • • , 6„. The support of a lattice point 
J2^i=i ciibi w.r.t. the given basis 61, 62, • • • , 6„ is the number of nonzero Oj. We now define the pa- 
rameterized feasible set of lattice points for parameter k and w.r.t. the given basis bi,b2,- ■ ■ ,bn to 
be 

n n 

jFfc(£) = {\J Qj6j G C I yj aibi has support at most k}. 

i=l i=l 

This immediately gives a natural parameterization for all the standard optimization problems for lat- 
tices. The problems pSVP, pCVP, and pSAP are the parameterized versions of the shortest vector 
problem, closest vector problem, and the subspace avoiding problem respectively, where the input 
instances come with a parameter value k and the feasible set for these problems is Fk{C), where C is 
the input lattice with a given basis. 

Based on the AKS sampling procedure we can easily show that the problems pSVP, pCVP, and 
pSAP all have randomized algorithms with running time (n + k)'~'^''\ On the other hand, we show 
that pCVP and pSAP are hard for W[l] w.r.t. fpt reductions. 

Theorem 5, The parameterized problems pSVP, pCVP, and pSAP all have randomized algorithms 
with time bound (n + k.)^^^> ■ poly(s), where s is the input size encoded in binary. 



Proof. We first explain the simple algorithm for pCVP. The problem pSVP is similarly solved, and 
pSAP can be solved by using the algorithm for pCVP. Let (w,£, k) be input instance for pCVP, 
where C is given by basis 61, 62, • " " > ^n- We will generate (^) many lattices Cs,S C [?t^], 15*1 = k, 
where £5 is the rank k lattice generated by the k vectors {bj \ j G S}. The feasible set T^ is 
the union of all these lattices Cs- Thus, it suffices to solve each of the (^) CVP instances {v, Cs) 
and pick the best solution among them. By using Kannan's algorithm [Kan87] we can solve each 
of these instances in time 2^^"^^ ■ poly(size(f ,£)). Thus, we can solve the pCVP instance in time 
n^ . 2^i°g'^ . poly(size(t;,£)), as claimed. The algorithm for pSVP is exactly on the same lines. For 
pSAP we need to apply ideas from Theorem 2. We showed in Theorem 2 that for an instance (£, M) 
of SAP, where M is ^-dimensional, we can find the shortest vector in £ \ M by solving 2*^^") instances 
of the kind {vi,Cn M) and taking the best solution among them. The key point here is that £ n M is 
a rank £ lattice implying that Kannan's algorithm finds exact solution in time 2^'°^^ • poly(s), where 
s is a bound on input size. Applying the same idea to pSAP, we will first generate the (^') many 
instances {Cs, M) of instance of SAP, where M is ^-dimensional and £5 has rank k, where k is the 
parameter. Note that we can easily obtain lattice L'g in a A; dimensional space R by applying suitable 
linear transformation. Let M ' = M n -R. It is clear that dim{M') = t < k. Now, applying the method 
of Theorem 2 we can exactly solve of the SAP instances {L'g, M') by solving 2'-'^'^' many instances of 
rank t CVP instances, where t < k. The overall running time is easily seen to be {n + k) ^ ' •poly(s). 



We next show that pCVP is hard for W[l] (we show it for £2 norm which can be easily extended to 
any ip norm). We leave the question open whether pSVP is W[l]-hard or is fixed parameter tractable. 

Theorem 6. The parameterized problem pCVP is hard for W[l] under fpt many-one reductions. 

Proof. We give an fpt many-one reduction from the A;-perfect code problem to pCVP /c-perfect code 
problem is defined in [DFVW99] where it is shown to be W[l]-hard. An input instance of /c -perfect 
code is (G, k), where G = {V, E) is an undirected graph and the problem is whether there is a subset 
S (ZV such that \S\ = k and N{x),x G S* is a partition of V, where N{x) is a neighbourhood of x. 
Let \V\ = n. We can represent N{x) f or x G ^ as an n-dimensional 0-1 vector v^ that has a 1 in the 
i^^ position if and only if i G N{x). Thus, given a collection of these vectors Wj, i G y, we are asking 
if some A;-subset of the Vi's adds up to the all I's vector. Let Wi,i G V be n-dimensional vectors, 
where each Wi has a large positive integer M in the i*^ position and is elsewhere. To continue the 
reduction, for each i £ V we replace Vi with a 2n-dimensional vector Ui whose first n coordinates is 
the vector Vi, the next n coordinates is the vector Wi. Finally, we consider the vector u whose first n 
coordinates are all I's, the next n coordinates are all M's. Let £ C M^" denote the integer lattice with 
basis B = {ui \ i G V}, and consider the pCVP instance {u, £, k). We claim that there is a vector 
V £ C that is in ^fc(£) such that ||v — u||2 < {n — k)M if and only if (G, k) is a yes instance of 
the /c-perfect code problem. If (G, A;) is a yes instance then clearly there is such a vector v G .7^fc(£). 
For the converse, suppose v G J^k{C) such that ||v — ti||2 < {n — k)M. Suppose v = ^j^i oiijUi^. 
Notice that in any case | |f — u| I2 > (n — k)M. Furthermore, the last inequality is strict unless all the 
Oj =1. This in turn forces that (G, k) is a yes instance of the /c-perfect code problem. This completes 
the proof. ■ 



8 The complexity of unique- CVP 

In this section we consider the complexity of the search version of promise problem unique-CVP. 
Given an integer lattice £ C Q" and v G Q" with the promise that the closest vector to v in £ 
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is unique then the problem unique-CVP is to find such a vector. We show that the search version of 
unique-CVP with respect to any ip norm, 1 < p < cxd is as hard as search version of C VP. The proof is 
by a randomized many-one reduction of the search version of CVP to search version of unique-CVP. 
We can also show a similar reduction from search version of S VP to search version of unique-S VP for 
any £p norm. The unique-SVP problem has gained importance after Ajtai et al in [AD97] proposed a 
public-key cryptosystem whose security depends upon the worst-case hardness of a variant of unique- 
SVP. R. Kumar and D. Sivakumar in [KS99] have shown that the decision version of unique-SVP with 
respect to £2 norm is NP-hard under randomized reductions. More precisely, they show for a given 
lattice C and number d, checking if there is a i; G £ such that 1 1 v| I2 < dis NP-hard under randomized 
reductions, given that C has at most one vector (upto the sign) of length at most d. Their reduction is 
similar to the Valiant- Vazirani reduction for uniqueSAT [VV85]. 

Our reduction for unique-CVP is based on a general form of the isolation lemma [MVV87] due 
to Klivans-Spielman [KSOl] in which random weights are assigned to "isolate" a linear form from a 
collection. We give a brief sketch of the reduction and its correctness argument. By scaling up, we can 
assume that the CVP instance (£, v) is such that the input lattice £ C Z" and v = {vi,- ■ ■ , Vn) G Z,". 
We will make a suitable random scaling of coordinates to obtain a new instance {M,v') of CVP 
such that there is unique closest vector to v' in M with high probability, and moreover we can easily 
recover a closest vector to t; in £ given a closest vector to t;' in A^. We describe the reduction for the 
£2 norm. The same reduction will essentially work for all £p norms. 

Let bi,b2- ■ ■ ,bn G Z" be a basis of C Since we can replace v by ^^(mod C) which is easy to 
compute, there is no loss of generality in assuming v lies in the fundamental parallelepiped of C. The 
following claim is easy to show. 

Claim. Let £ C Z" be a lattice and v G Z". If iV is equal to number of closest vector to t; in £ then 
size{N) < {size{C, v)y, for some absolute constant c > 0. 

For the reduction, we pick oi, 02, • • • , a„ uniformly at random from {0, 1, • • • ,p} where p = 
8n ■ {size{C, f ))^^. Clearly, by the above claim p > 8niV^. Let K G Z+ that we will choose suitably 
large. Define Jk ■ M" — > M" as fxixi, •, a;„) = {{K + ai)xi, ■ ■ ■ ,{K + a„)x„). Clearly, Mr = 
{fK{x)\x G £} is an integer lattice with basis {//^(^i), fK{ti2), ■ ■ ■ , fK{bn)}- The following claim is 
easy to prove by direct calculation and bounding of £2 norms. 

Claim. Let s = size(£, v). Then there is an absolute constant c' > such that for any K > 2^" , if 
fK{x) G 7W is a vector closest to the vector Kv, then x G £ is a closest vector to v. 

From the above claim it follows that given a closest vector to Kv in M we can compute a closest 
vector to t; in £ in polynomial time. Next we prove that Kv has a unique closest vector in the lattice 
M with good probability. 

Let C = {x ^ C\x is a closest vector to v}. By the previous claim it is clear that for any vector 
z G A^ closest to Kv there is x G C such that z = fK{x). For x = (xi, • • • x„) G M" let wt{x) = 
Sf^i{{K + ai)xi — Kvi)^. An index i, 1 < i < n is a bad index if there are x = (xi, • • • , Xn),y = 
(yi, • • • , yn) G C* such that wt{x) = wt{y) and Xj / yi. 

Lemma 2. An index i, 1 < i < n is a bad index with probability at most l/2n, where the probability 
is over the random choice o/ai, • • • , a„. Hence there is a bad index with probability at most 1/2. 

Proof. Recall that we pick each Oj independently and uniformly at random from < Oj < Sns^'^. 
Assume we have randomly picked all Oj for j / i, where i is some specific index. Since all Oj ,jj^i 
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are already picked, for every x G C notice that wt{x) = {{K + ai)xi — KviY + N^ is a quadratic 
polynomial in the indeterminates a^, where N^ is a fixed integer that depends only on x and v. Thus, 
we have an associated quadratic for each x e C, and as already argued \C\ < s^. Now, by Bezout's 
theorem any 2 quadratic curves can intersect in at most four points. Thus, if we consider pairwise 
intersection of the quadratics we have at most As'^'^ distinct intersection points. Clearly, if Oj takes a 
value different from any of these intersection points then wt{x) / wt{y) for distinct x,y ^ C. Since 
Qi is uniformly picked from [0..8ns'^'^], the index i is a bad index with probability at most l/2n. As a 
consequence of the union bound it follows that there is a bad index with probability at most 1/2. This 
proves the lemma. ■ 

Clearly, if there is no bad index for a random assignment to the Oj, there is a unique closest vector 
in Mi to Kv. Hence the randomized many-one reduction succeeds with probability at least 1/2. This 
completes the correctness proof. It is easy to see that above argument can be applied for any £p metric. 
We summarize the result below. 

Theorem 7. For any ip norm there is a randomized polynomial time many-one reduction from the 
search version ofCVP to the search version of unique-CVP. 

With some modifications to the randomized reduction, we can show that the search version of 
SVP (and SAP) is reducible to search version of unique-SVP (respectively unique-SAP). 
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A Proof of Theorem 4 

Proof Sketch. We sketch the adversay argument only for deterministic algorithms (the randomized 
case is essentially the same). Notice that the i-2 norm is in F as there are exactly 2n shortest nonzero 
vectors in Z" w.r.t. I2 norm. This is the set U = {±ei, ±62, • • • , ±e„} where Cj are the standard basis 
vectors in Z". 

Now, suppose A is an algorithm that makes at most q{n) = o(2") queries on any input. The 
adversary will answer all queries w.r.t. the £2 norm. Let T = {xi, X2, • • • , a;^}, k < q{n) be the set 
of vectors queried by A. We can assume without loss of generality that U (^ T. Specifically, the 
adversary outputs /(xj) = ||xi||2 = Cj for each query Xi G T. Notice, for each query Vi G U, that the 
adversary outputs f{vi) = 1 = ||vi||2- 

Finally, suppose the algorithm outputs a set S as the set of shortest vectors. By choice of F, 
\S\ < n^.lfU 2 S then the adversary can set the actual input gauge function to £2 implying that the 
algorithm A is incorrect. Thus, we can assume U C S. 

Consider the 2" quadrants of M" formed by the standard coordinate axes. We can describe 
the 2" quadrants Qz by vectors z G {1,-1}", where the quadrant Qz consists of all points 
(xi,X2, • • • ,Xn) G M", where Xj's are all nonzero and Xj and Zi have the same sign. Notice that 
each such z G Z" is the unique lattice point in quadrant Qz with £2 norm ^/n. Since |T U 5*1 = o(2"), 
for sufficiently large n we have |T U S"] < 2"^^. Hence there exists a lattice point y = (yi, • • • , y„) G 
{1, —1}" such that no point from T U S lies in the quadrants Qy or Q-y. 

Next we define an 0-symmetric convex body C. Consider the quadrants Qy and Q-y. 

The bounding axes of quadrant Qy intersect the sphere ^2(0, 1) in the points Pi = 
(0, 0, • • • , 0, yj, 0, • • • , 0) for i = 1 to n. Clearly, i-*i, • • • , P„ lie on a n — 1 dimensional hyperplane 
that intersects ^2 (0, 1) in an n — 1 dimensional sphere My. Let Cy be the n-dimensional right-circular 
cone with base My and vertex of cone at y. Similarly, we obtain a right circular cone C-y correspond- 
ing to —y. We define C = Cy U C-y U i32(0, 1). It is easy to see that C is an 0-symmetric convex 
body. Let T' = {injyr I v G T}. Clearly, the points {y, —y} U T' lie on the surface of convex body C. 
By Proposition 1 this defines a gauge function / such that Bf{0, 1) = C. Notice that / is a nice gauge 
function since i?2(0, 1) C C C i?2(0, \/n)- Hence we have a nice gauge function / and a lattice point 
y G Z" \ S* such that f{y) = 1 and for all x^ G T', f{x'j) = 1. Thus, the shortest vector set for this 
gauge function is the set U U {y, —y} which is not the set output by the algorithm^. This proves the 
theorem. ■ 



14 



